Multiple Vulnerabilities in Adobe Products Could Allow for Arbitrary Code Execution

ITS ADVISORY NUMBER:

2021-067-UPDATED

DATE(S) ISSUED:

Tuesday, May 11, 2021

DATE UPDATED:

Wednesday, May 12, 2021

SUBJECT:

Multiple Vulnerabilities in Adobe Products Could Allow for Arbitrary Code Execution

OVERVIEW:

Multiple vulnerabilities have been discovered in Adobe Products, the most severe of which could allow for arbitrary code execution.

Acrobat and Reader is a family of application software and Web services mainly used to create, view, and edit PDF documents.
Animate is a multimedia authoring computer animation program.
Experience Manager is a content management solution for building websites, mobile apps, and forms.
InCopy is a professional word processor.
InDesign is an industry-leading layout and page design software for print and digital media.
Illustrator is a vector graphics editor and design program.

Successful exploitation of the most severe of these vulnerabilities could allow for arbitrary code execution. Depending on the privileges associated with the user an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.

May 12 - UPDATED OVERVIEW:

Multiple vulnerabilities have been reported in Magento, Adobe Medium and Adobe After Effects, the most severe of which could allow for arbitrary code execution.

Magento is a leading provider of cloud commerce innovation to merchants and brands across B2C and B2B industries.
Medium is a digital sculpting software that works with virtual reality headsets and 6DoF motion controllers. It is used to create and paint digital sculptures.
After Effects is a digital visual effects, motion graphics, and compositing application.

THREAT INTELLIGENCE:

There are currently no reports of these vulnerabilities being exploited in the wild.

SYSTEMS AFFECTED:

Acrobat 2020 and Acrobat Reader 2020 versions prior to 2020.001.30025
Acrobat 2017 and Acrobat Reader 2017 versions prior to 2017.011.30196
Adobe Animate versions prior to 21.06
Adobe Experience Manager versions prior to 6.4.8.4 and 6.5.8.0
Adobe InCopy versions prior to 16.2.1
Adobe InDesign versions prior to 16.2.1
Adobe Illustrator versions prior to 25.2.3

May 12 - UPDATED SYSTEMS AFFECTED:

Magento Commerce versions prior to 2.4.2-p1
Magento Commerce versions prior to 2.3.7
Magento Open Source versions prior to 2.4.2-p1
Magento Open Source versions prior to 2.3.7
Adobe After Effects versions prior to 18.2
Adobe Medium versions prior to 2.4.5.332

RISK:

Government:

Large and medium government entities: High

Small government entities: Medium

Business:

Large and medium business entities: High

Small business entities: Medium

Home Users: Low

DESCRIPTION:

Multiple vulnerabilities have been discovered in Adobe Acrobat, Animate, Illustrator, and InDesign, the most severe of which could allow for arbitrary code execution. Details of these vulnerabilities are as follows:

Adobe Acrobat and Reader:

Out-of-bounds read error vulnerability, which could allow for memory leak. (CVE-2021-28557)
Out-of-bounds read error vulnerabilities, which could allow for arbitrary code execution. (CVE-2021-28555, CVE-2021-28565)
Out-of-bounds write error vulnerabilities, which could allow for arbitrary code execution. (CVE-2021-28564, CVE-2021-21044, CVE-2021-21038, CVE-2021-21086)

Adobe Animate:

Use-after-free error vulnerability, which could allow for arbitrary code execution. (CVE-2021-28578).
Out-of-bound write error vulnerability, which could allow for arbitrary code execution. (CVE-2021-28577)
Out-of-bounds read error vulnerabilities, which could allow for information disclosure. (CVE-2021-28572, CVE-2021-28573, CVE-2021-28574, CVE-2021-28575, CVE-2021-28576)

Adobe Experience Manager:

Improper access control vulnerability, which could allow for denial-of-service. (CVE-2021-21083)
Cross-site scripting vulnerability, which could allow for arbitrary JavaScript execution. (CVE-2021-21084)

Adobe InCopy:

Path traversal vulnerability, which could allow for arbitrary code execution. (CVE-2021-21090)

Adobe InDesign:

Out-of-bounds write error vulnerability, which could allow for arbitrary code execution. (CVE-2021-21098, CVE-2021-21099, CVE-2021-21043)

Adobe Illustrator:

Out-of-bounds write error vulnerability, which could allow for arbitrary code execution. (CVE-2021-21101)
Path traversal vulnerability, which could allow for arbitrary code execution. (CVE-2021-21102)
Memory corruption error vulnerabilities, which could allow for arbitrary code execution. (CVE-2021-21103, CVE-2021-21104, CVE-2021-21105)

May 12 - UPDATED DESCRIPTION:

Multiple vulnerabilities have been discovered in Magento, Adobe Medium and Adobe Affect Effects, the most severe of which could result in arbitrary code execution. Details of these vulnerabilities are as follows:

Magento Commerce and Magento Open Source:

Information Disclosure, which could allow for disclosure of document root path. (CVE-2021-28566)
Improper Authorization, which could allow for unauthorized modification of customer data. (CVE-2021-28567)
Cross-site scripting (DOM-based), which could allow for arbitrary JavaScript execution in the browser. (CVE-2021-28556)
Improper Authorization, which could allow for unauthorized access to restricted resources. (CVE-2021-28563)
Violation of Secure Design Principles, which could allow for unauthorized access to restricted resources. (CVE-2021-28583)
Path traversal, which could allow for arbitrary file system write. (CVE-2021-28584)
Improper input validation, which could allow for security feature bypass. (CVE-2021-28585)

Adobe Affect Effects:

OS Command Injection, which could allow for arbitrary code execution. (CVE-2021-28571)

Adobe Medium:

Improper Input Validation, which could allow for arbitrary code execution. (CVE-2021-28580)

ACTIONS:

After appropriate testing, immediately install the updates provided by Adobe.
Run all software as a non-privileged user (one without administrative privileges) to diminish the effects of a successful attack.
Remind users not to visit un-trusted websites or follow links provided by unknown or un-trusted sources.
Inform and educate users regarding the threats posed by hypertext links contained in emails or attachments especially from un-trusted sources.
Apply the Principle of Least Privilege to all systems and services.

REFERENCES:

Adobe:
https://helpx.adobe.com/security.html
https://helpx.adobe.com/security/products/acrobat/apsb21-29.html
https://helpx.adobe.com/security/products/animate/apsb21-35.html
https://helpx.adobe.com/security/products/experience-manager/apsb21-15.html
https://helpx.adobe.com/security/products/incopy/apsb21-25.html
https://helpx.adobe.com/security/products/indesign/apsb21-22.html
https://helpx.adobe.com/security/products/illustrator/apsb21-24.html

May 12 - UPDATED REFERENCES:
Adobe:
https://helpx.adobe.com/security/products/magento/apsb21-30.html
https://helpx.adobe.com/security/products/after_effects/apsb21-33.html
https://helpx.adobe.com/security/products/medium/apsb21-34.html

Multiple Vulnerabilities in Adobe Products Could Allow for Arbitrary Code Execution

Translation Services